Discussion Locked

shared drivers in XP

0 helpful
4 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

For all the world, it appears that someone has produced a hack which makes it possible for an outside person to modify files on our harddrive. I found when we run a reg clean, we always, ALWAYS get shared dlls show up.
I read about removing $ signs in appropriate folders for NT, but what about for XP? Total we have about 75 gigs of programs and files at stake, and its not a little thing for some 'person' [I use the term lightly] to get into our hard drive from a remote location.

4 replies

by cg it

ah, dynamic link libraries are shared between programs so I don't think someone hacked and left orphaned DLLs laying around. If you use add/remove programs to remove a program, some DLLs are orphaned and a reg cleaner would find em but that isn't indicitive of being hacked.

by cg it

one other thing the $ sign hides the share. removing it would make it visible as a share.

by cg it

I sent you a pm regarding auditing object access to track who accesses a file or folder. Again, if you have a serious problem such as someone modifing files, you should review your security policies. If you run NTFS file system, and you run the audit object access and find the offending person you can remove them from the ACL. Further, a best practice is to remove the everyone group from the basic shared folder permissions. Everyone group literally means everyone [you, your pet dog, and the guy down the street and everyone in the whole world should they gain access]. you should create groups and assign permissions to shares by groups. then you assign users to the group to give them permission to the share. If the user isn't a member of the group they can't get access [this is NTFS permissions].

by thechas

Aside from installing and removing programs, DLL share problems will show up in a registry cleaning check for a number of reasons.

My first question would be what software (and version) are you using for registry cleaning?
None of the registry cleaners I have tried are perfect.
They all miss some problems and detect good keys as bad.

Just the process of running a program that created the shared DLL key that your registry cleaner detects as bad could re-create the key.

Some keys that show up as bad in a registry clean are simply bad because the program uses that key along with a temporary file that is removed when you close the program.

As far as securing your system, the first step is a good software firewall.

Even if you only have a dial-up connection to the Internet, a firewall is now a must have.

There are a number of good choices out there. The one recommended most often by peers here at TR is Zone Alarm from www.zonelabs.com

If this is a business network, a good hardware firewall is a must.

Next, assuming your drives are formatted as NTFS volumes, you can enable security on selected files and folders.

Open Windows Explorer.
Browse to the folder or file you wish to secure.
Right click on the file or folder and select sharing and security options.
Set the security options as needed.

Chas

This discussion is closed to new replies.